This is an automated email from the ASF dual-hosted git repository.
vincbeck pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 25c9c0557e6 Update SecretsManagerBackend to support multi-team (#65395)
25c9c0557e6 is described below
commit 25c9c0557e6ff3bdeaf8185ba2977cf77339eae3
Author: Justin Pakzad <[email protected]>
AuthorDate: Mon Apr 20 14:07:47 2026 -0400
Update SecretsManagerBackend to support multi-team (#65395)
---
.../amazon/aws/secrets/secrets_manager.py | 15 ++++++++++----
.../amazon/aws/secrets/test_secrets_manager.py | 24 ++++++++++++++++++++++
2 files changed, 35 insertions(+), 4 deletions(-)
diff --git
a/providers/amazon/src/airflow/providers/amazon/aws/secrets/secrets_manager.py
b/providers/amazon/src/airflow/providers/amazon/aws/secrets/secrets_manager.py
index 3ec98f0a629..93210798b06 100644
---
a/providers/amazon/src/airflow/providers/amazon/aws/secrets/secrets_manager.py
+++
b/providers/amazon/src/airflow/providers/amazon/aws/secrets/secrets_manager.py
@@ -207,7 +207,9 @@ class SecretsManagerBackend(BaseSecretsBackend,
LoggingMixin):
if self.connections_prefix is None:
return None
- secret = self._get_secret(self.connections_prefix, conn_id,
self.connections_lookup_pattern)
+ secret = self._get_secret(
+ self.connections_prefix, conn_id, self.connections_lookup_pattern,
team_name
+ )
if secret is not None and secret.strip().startswith("{"):
# Before Airflow 2.3, the AWS SecretsManagerBackend added support
for JSON secrets.
@@ -237,7 +239,7 @@ class SecretsManagerBackend(BaseSecretsBackend,
LoggingMixin):
if self.variables_prefix is None:
return None
- return self._get_secret(self.variables_prefix, key,
self.variables_lookup_pattern)
+ return self._get_secret(self.variables_prefix, key,
self.variables_lookup_pattern, team_name)
def get_config(self, key: str) -> str | None:
"""
@@ -251,7 +253,9 @@ class SecretsManagerBackend(BaseSecretsBackend,
LoggingMixin):
return self._get_secret(self.config_prefix, key,
self.config_lookup_pattern)
- def _get_secret(self, path_prefix, secret_id: str, lookup_pattern: str |
None) -> str | None:
+ def _get_secret(
+ self, path_prefix, secret_id: str, lookup_pattern: str | None,
team_name: str | None = None
+ ) -> str | None:
"""
Get secret value from Secrets Manager.
@@ -264,7 +268,10 @@ class SecretsManagerBackend(BaseSecretsBackend,
LoggingMixin):
return None
error_msg = "An error occurred when calling the get_secret_value
operation"
- if path_prefix:
+ if path_prefix and team_name:
+ secrets_path = self.build_path(path_prefix, team_name, self.sep)
+ secrets_path = self.build_path(secrets_path, secret_id, self.sep)
+ elif path_prefix:
secrets_path = self.build_path(path_prefix, secret_id, self.sep)
else:
secrets_path = secret_id
diff --git
a/providers/amazon/tests/unit/amazon/aws/secrets/test_secrets_manager.py
b/providers/amazon/tests/unit/amazon/aws/secrets/test_secrets_manager.py
index ea4b2e4a658..5a4c669775a 100644
--- a/providers/amazon/tests/unit/amazon/aws/secrets/test_secrets_manager.py
+++ b/providers/amazon/tests/unit/amazon/aws/secrets/test_secrets_manager.py
@@ -65,6 +65,20 @@ class TestSecretsManagerBackend:
assert secrets_manager_backend.get_conn_value(conn_id=conn_id) is None
assert secrets_manager_backend.get_connection(conn_id=conn_id) is None
+ @mock_aws
+ def test_get_conn_value_with_team_name(self):
+ secret_id = "airflow/connections/my_team/test_postgres"
+ create_param = {
+ "Name": secret_id,
+ "SecretString": "postgresql://airflow:airflow@host:5432/airflow",
+ }
+
+ secrets_manager_backend = SecretsManagerBackend()
+ secrets_manager_backend.client.create_secret(**create_param)
+
+ returned_uri =
secrets_manager_backend.get_conn_value(conn_id="test_postgres",
team_name="my_team")
+ assert returned_uri == "postgresql://airflow:airflow@host:5432/airflow"
+
@mock_aws
def test_get_variable(self):
secret_id = "airflow/variables/hello"
@@ -90,6 +104,16 @@ class TestSecretsManagerBackend:
assert secrets_manager_backend.get_variable("test_mysql") is None
+ @mock_aws
+ def test_get_variable_with_team_name(self):
+ secret_id = "airflow/variables/my_team/hello"
+ create_param = {"Name": secret_id, "SecretString": "world"}
+
+ secrets_manager_backend = SecretsManagerBackend()
+ secrets_manager_backend.client.create_secret(**create_param)
+
+ assert secrets_manager_backend.get_variable(key="hello",
team_name="my_team") == "world"
+
@mock_aws
def test_get_config_non_existent_key(self):
"""
